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DETAILED ACTION 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

1. Claims 1-5 is rejected under 35 U.S.C. 103(a) as being unpatentable over Marco 

(6,266,337) in view of Callon (6,870,849) and Chen (US 6,859,433). 

Regarding claim 1, Marco describes a method for determining the packet 
signature (cyclical redundancy check CRC) value in a router, comprising: 

receiving a packet at the router (col. 4, lines 19-20); 

zeroing out the selected fields, and computing the signature of the received 
packet (replacing) the CRC (/signature) of the packet (col. 4, lines 20-27, where the 
packet CRC and TTL fields are the selected fields being zeroed out for the computation 
of a new CRC signature); 

Marco fails to describe: computing a signature (CRC hash value) of the router's 
network address. 

Callon describes: computing a signature (CRC hash value) of the router's 
network address (col. 5, lines 39-48, 53-56 & col. 6, lines 44-49, where the hash 
value/signature is initially computed) for the purpose of providing a unique value to the 
router/node and identifies a unique transmitting path). 
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It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to incorporate the initial computation of the node's signature 
when recalculating the packet CRC for transmission. The motivation is that it provides a 
unique value to the router/node and identifies a unique transmitting path. 

Marco further describes that the method is used at the ingress point of a network 
(Marco, fig. 1, located at transmission/starting point of the network). Marco and Callon 
combined fails to describe: 

using the signature in determining a point of ingress for the packet when it 
entered a network. 

Chen describes: 

using the signature in determining a point of ingress for the packet when it 
entered a network (col. 5, lines 50-56, where the calculated CRC (signature) modulo 
value is used to determine the output port [ingress to the core network]). 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to describe using the signature in determining the output port 
(ingress point) to the network as per Chen for the combined method of Marco and 
Callon. 

The motivation for combining the teachings is that it provides increase the overall 
network data communication efficiency (Chen, col. 3, lines 19-22). 

Regarding claim 2, Marco further describes that the selected fields may be a 
checksum or time-to-live field (col. 4, lines 20-27, where the packet CRC = checksum); 
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Regarding claims 3, Marco and Callon combined further describe that the 
signature of the packet network address being a CRC (Marco, col. 4, lines 20-21) and 
the signature of the router's network address also being a CRC (Callon, col. 5, lines 53- 
56). 

Regarding claim 4, Marco further describes that the CRCs can be CRC-32 (col. 
4, lines 22-24). 

Regarding claim 5, CRCs, per definition and as well-known in the art, can be 
classified as a type of hash values in a computation (see also Callon, col. 2, lines 12-14 
& col. 5, lines 53-56). 

2. Claims 6-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Marco in view of Callon and Malan (2002/0032871). 

Regarding claim 6, Marco describes a method archiving signatures with packets 
received at nodes in a network, comprising: 

receiving packets at a plurality of the nodes in the network (col. 4, lines 19-20); 

computing the second signature of the packet (col. 4, lines 20-21, where the 
packet CRC is the second signature being calculated); 

archiving CRCs (second signatures) in a memory device (fig. 4, #106 & col. 4, 
lines 30-32 &). 

In view of claim 6, Marco lacks what Callon describes: 

computing at each network node a first signature (CRC hash value) of its network 
address (col. 5, lines 39-48, 53-56 & col. 6, lines 44-49, where the CRC hash value is 
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initially computed) for the purpose of providing a unique value to the router/node and 
identifies a unique transmitting path. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to incorporate the initial computation of the node's signature 
when recalculating the packet CRC for transmission. The motivation is that it provides a 
unique value to the router/node and identifies a unique transmitting path. 

Marco and Callon combined fail to describe: 

providing the archived one or more computed second signatures to an agent for 
tracing a path that a given packet traversed in a network. 
Malan describes: 

providing the archived one or more computed second signatures to an agent for 
tracing a path that a given packet traversed in a network (paragraphs 77 & 78, where 
the controller 24 (agent) is used to trace a path that the attack (given) packet traversed 
in a network using the attack packet's signature (computed second signature)). 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to describe using the signature for tracing a path that a given 
packet traversed in a network as described by Malan for the combined method of Marco 
and Callon. 

The motivation for combining the teachings is that it provides a method for 
tracking and blocking DoS attacks over a computer network (Malan, paragraph 27). 

Regarding claim 7, Marco further describes computing a CRC of each received 
packet (col. 4, lines 20-21, where the packet CRC is calculated). 
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Regarding claim 8, CRCs, per definition and as known in the art, can be 
classified as a type of hash values in a computation (see also Callon, col. 2, lines 12-14 
& col. 5, lines 53-56). 

Regarding claim 9, Marco further describes that the CRCs can be CRC-32 (col. 
4, lines 22-24). 

3. Claim 10-13, 15 and 17-18 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marco in view of Malan. 

Regarding claim 10, Marco describes a method of archiving signatures 
associated with packets received at a node in a network, comprising: 

receiving packets at the node (col. 4, lines 19-20); 

computing a signature (CRC) for each received packet (col. 4, lines 20-21 , 
where the packet CRC is calculated); 

aggregating the computed signature (CRC) in a first memory to produce 
signature vectors (hash table of CRCs), and archiving the table in a second memory 
(col. 4, lines 37-39, where memory holding the calculated checksum is different from the 
hash table memory, fig. 2, #54). 

Marco fails to describe: 

providing the archived one or more computed second signatures to an agent for 
tracing a path that a given packet traversed in a network. 
Malan describes: 
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providing the archived one or more computed second signatures to an agent for 
tracing a path that a given packet traversed in a network (paragraphs 77 & 78, where 
the controller 24 (agent) is used to trace a path that the attack (given) packet traversed 
in a network using the attack packet's signature (computed second signature)). 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to describe using the signature for tracing a path that a given 
packet traversed in a network as described by Malan for the method of Marco. 

The motivation for combining the teachings is that it provides a method for 
tracking and blocking DoS attacks over a computer network (Malan, paragraph 27). 

Regarding claims 11, Marco further describes computing a CRC of each 
received packet (col. 4, lines 20-21, where the packet CRC is calculated). 

Regarding claim 12, CRCs, per definition and as well-known in the art, can be 
classified as a type of hash values in a computation (see also Callon, col. 2, lines 12-14 
& col. 5, lines 53-56). 

Regarding claim 13, Marco further describes that the computed CRCs are CRC- 
32 (col. 4, lines 22-24). 

Regarding claim 15, Marco further describes that the signatures (computed 
CRC) are aggregated over a collection interval (col. 5, lines 9-19, where the CRCs are 
aggregated in a hash table for a certain time interval until they are old). 

Regarding claim 17, Marco further describes storing the fraction of the CRC 
table in the data memory by the collection interval (col. 4, lines 37-39 & col. 5, lines 9- 
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19, where the CRC table is a fraction of all CRCs archived over time because older 
checksums are periodically being cleared). 

Regarding claim 18, Marco further describes that the archived signature vectors 
(CRC table) are cleaned/discarded over time (P seconds) (col. 5, lines 9-19, where the 
periodic clearing/deletion of old checksums may be P seconds). 

4. Claims 14 and 23 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Marco in view of Malan as applied to claim 10, and further in view of Sato 
(6,947,442). 

Regarding claims 14, Marco and Malan combined fails to describe that the 
second memory comprises a ring buffer. 

Sato describes: the second memory comprises a ring buffer (fig. 8 and col. 8, 
lines 61-62, where the memory is the second memory) for the purpose of speeding up 
the processing performed within the node. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to deploy a ring buffer memory scheme. The motivation is that it 
speeds up the processing performed within the node (col. 4, lines 37-42). 

Regarding claims 23, Marco and Malan combined fails to describe that the 
second memory comprises a DRAM. 

Sato describes: the second memory comprises a DRAM (col. 8, lines 61-62) for 
the purpose of allowing high speed data transfers. 
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It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to use DRAM as the second memory as in Sato for the method of 
Marco. The motivation is that this memory type allows high speed data transfers (Sato, 
abstract & col. 1, lines 40-41, 56-58). 

5. Claims 16 is rejected under 35 U.S.C. 103(a) as being unpatentable over Marco 
in view of Malan as applied to claim 15 above, and further in view of Carr (6,519,264). 

Regarding claim 16, Marco and Malan combined fails to describe: 
storing signatures in the second memory indexed by the collection interval. 
Carr describes: 

storing signatures (VC) in the second memory indexed by the collection interval 
(fig. 3, step 52 & col. 1 1 , lines 50-52, where a VC = signature and T = indexed collection 
window interval to the buffer depicted in fig. 4, #20 & 22) for the purpose of allowing 
continuous memory approach for storing means. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to use the collection window interval for indexing a memory as in 
Carr for the combined method of Marco and Malan. The motivation is that this 
approach allows continuous memory approach for storing means, versus a limited time- 
based storage by a finite linear array/memory (Carr, col. 10, lines 46-55). 

6. Claims 24-27, 29 and 31-32 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marco. 
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Regarding claim 24, Macro describes an apparatus for archiving signatures 
(CRC) associated with the received packets in a network, comprising: 

a first and second memory ((col. 4, lines 37-39, where [first] memory holding the 
calculated checksum is different from the hash table memory, fig. 2, #54); 

a signature tap (fig. 2, CRC generator 50) configured to: 

receive packets at the node (col. 4, lines 20-21); 

compute one or more signatures for each of the received packets (col. 4, lines 
21-22); 

a controller (fig. 2, packet routing controller 58) configured to: 
archive the signature vector (CRC table) in the second memory (col. 4, lines 21- 
22 and fig. 2, CRC table #54 the in data memory #56); 
In view of claim 24, Marco fails to describe: 

a multiplexer for to multiplex/aggregate computed signatures stored in first 
memory into one signature vector to be archived in the second memory 

The examiner takes official notice that it is common practice in the current state 
of art of storage to multiplex/aggregate computed signatures (inherently in a first 
memory) to be stored in a second memory (as per Lloyd in US patent 5,802,522, col. 2, 
lines 31-34, where common data elements (signatures) are grouped and stored in data 
blocks (vectors)). 

The motivation for grouping the data elements for storing the data is that it 
reduces the amount of time need to load data from mass storage back into the memory 
(Lloyd, col. 1, lines 39-41 & col. 2, lines 25-27). 
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Regarding claim 25, Marco further describes that the signature vectors (CRC 
table) comprises CRC values (col. 4, lines 21-22); 

Regarding claim 26, Marco further describes that the signature vectors (CRC 
hash table) comprises CRC values (col. 4, lines 31-33), which inherently is considered 
as hash values. 

Regarding claim 27, Marco further describes that the CRCs are CRC-32's (col. 
4, lines 21-24). 

Regarding claim 29, Marco further describes adding/aggregating signatures 
(CRCs) over a collection interval (col. 4, lines 37-39 & col. 5, lines 9-19). 

Regarding claim 31, Marco further describes storing the fraction of the signature 
vectors (CRC table) in the data memory by the collection interval (col. 4, lines 37-39 & 
col. 5, lines 9-19, where the CRC table is a fraction of all CRCs archived over time). 

Regarding claim 32, Marco further describes that the archived signature vectors 
(CRC table) are cleaned/discarded over time (P seconds) (col. 5, lines 9-19, where the 
periodic clearing/deletion of old checksums may be P seconds). 

7. Claim 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over Marco 
as applied to claim 24, and further in view of Sato (6,947,442). 

Regarding claim 28, Marco fails to describe that the second memory comprises a 
ring buffer. 
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Sato describes: the second memory comprises a ring buffer (fig. 8 and col. 8, 
lines 61-62, where the memory is the second memory) for the purpose of speeding up 
the processing performed within the node. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to deploy a ring buffer memory scheme. 

The motivation for combining the teachings is that it speeds up the processing 
performed within the processing node (col. 4, lines 37-42). 

8. Claims 30 is rejected under 35 U.S.C. 103(a) as being unpatentable over Marco 
as applied to claim 29, and further in view of Carr (6,519,264). 
Regarding claim 30, Marco fails to describe: 

storing signatures (VC) in the second memory indexed by the collection interval. 
Carr describes: 

storing signatures (VC) in the second memory indexed by the collection interval 
(fig. 3, step 52 & col. 11, lines 50-52, where a VC = signature and T = indexed collection 
window interval to the buffer depicted in fig. 4, #20 & 22) for the purpose of allowing 
continuous memory approach for storing means. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to use the collection window interval for indexing a memory as in 
Carr for the method of Marco. 
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The motivation for combining the teachings is that this approach allows 
continuous memory approach for storing means, versus a limited time-based storage by 
a finite linear array/memory (Carr, col. 10, lines 46-55). 

9. Claim 37 is rejected under 35 U.S.C. 103(a) as being unpatentable over Marco 
as applied to claim 24, and further in view of Sato (6,947,442). 

Regarding claim 37, Marco fails to describe that the second memory comprises a 
DRAM. 

Sato describes that the second memory comprises a DRAM (col. 8, lines 61-62) 
for the purpose of allowing high speed data transfers. 

It would have been obvious to one with ordinary skill in the art at the time of 
invention by applicant to use DRAM as the second memory as in Sato for the method of 
Marco. 

The motivation for combining the teachings is that this memory type allows high 
speed data transfers (Sato, abstract & col. 1, lines 40-41, 56-58). 



Claim Rejections - 35 USC § 102 
10. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
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only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

1 1 . Claim 38 is rejected under 35 U.S.C. 102(e) as being anticipated by Marco. 
Marco describes a method of archiving CRCs (signatures) associated with 

packets received at a node in a network, comprising: 
receiving packet at the node (col. 4, lines 20-21); 

computing signatures (CRCs) in a first memory to produce a signature vectors 
(CRC hash table) (col. 4, lines 20-21 & 37-39, where new CRCs are computed and 
stored in the CRC hash table); 

adding/aggregating the computed signatures (CRCs) in a first memory to 
produce the CRC table (signature vector) which is archived in the data (second) 
memory (col. 4, lines 37-39 and fig. 2, #160). 

Allowable Subject Matter 

12. Claims 19-22 and 33-36 are objected to as being dependent upon a rejected 
base claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

13. Claims 39-40 allowed. 

The following is a statement of reasons for the indication of allowable subject 

matter: 

For claim 39, the prior art fails to disclose the limitations of "using each of the one 
or more signatures as addresses for addressing bit location in the first memory, and set 
memory bits in the addresses of the first memory corresponding to each of the one or 
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more signatures", where a [packet] signature corresponds to a digital signature of either 
a CRC, checksum, or hash value as known in the art and per the specification. 

For claim 40, the prior art fails to disclose the limitations of "store, over a 
collection interval, the determined at least one signature packet for each of the plurality 
of received packets in the first memory to produce a signature vector that comprises a 
block of plurality of signatures for at least a portion of the received packets", where a 
[packet] signature corresponds to a digital signature of either a CRC, checksum, or 
hash value as known in the art and per the specification. 

Response to Arguments 

14. Applicant's arguments with respect to claims 1-36 have been considered but are 
moot in view of the new ground(s) of rejection. 

Conclusion 

15. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: Stacey (2005/0213570) and Levy (US 6,134,662). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Warner Wong whose telephone number is 571-272- 
8197. The examiner can normally be reached on 6:30AM - 3:00PM, M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ricky Ngo can be reached on 571-272-3139. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Warner Wong 
Examiner 
Art Unit 2616 
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